Privacy Policy
Last updated: 2026-10-16
Waribiki Alert (waribiki.gaijindev.com, "we", "us") is a GaijinDev project operated in Japan by Aaron Chanthavong. This policy explains what personal information we handle and why, and what your rights are under Japan's Act on the Protection of Personal Information (個人情報の保護に関する法律, "APPI"). If you are in the EU or the UK, section 12 also applies to you.
1. Summary
- You can browse the site without giving us any personal information. We set no tracking or advertising cookies. Our host Cloudflare may set a strictly necessary security cookie (such as cf_clearance) to protect the site from abuse. Strictly necessary cookies don't need consent, so there's no cookie banner.
- If you sign up for the email, we keep your email address and whether you're a visitor, a resident or both. We use them only to send you Waribiki Alert emails.
- Service providers handle data for us: Cloudflare and beehiiv for everyone, and Stripe for sponsors who pay online. Google also receives email you send us. All are in the USA.
- We don't sell your information, and we never give subscriber lists to sponsors.
- You can unsubscribe at any time, and you can ask us to show you, correct or delete your data.
2. Operator (個人情報取扱事業者)
- Name: Aaron Chanthavong (Waribiki Alert, a GaijinDev project), operated in Japan
- Address: disclosed without delay upon request
- Contact: aaron@gaijindev.com
3. What we collect
When you sign up for the email
- Email address (required).
- Whether you are visiting Japan, living in Japan, or both, chosen in the signup form.
- Signup details: the form you used, the date and time, and the plan (free).
We save your signup in our database, hosted by Cloudflare, and pass your email address, your visitor/resident/both choice and the fact that you signed up on waribiki.gaijindev.com to beehiiv, which sends our emails.
To limit spam and abuse, we allow a limited number of signup attempts per hour from each connection. For this we keep a one-way hash of your IP address, not the address itself, along with the hour and the number of attempts. We use the hash for nothing else and delete it after 30 days.
Confirming your subscription (double opt-in)
After you sign up, beehiiv sends you a confirmation email with a link. You're subscribed only after you click it. If you don't confirm, you won't receive the newsletter.
When you read our emails
beehiiv records whether our emails are opened and which links are clicked, and it adds tracking tags (UTM parameters) to links in our emails. We use these statistics to see which deals readers find useful, and we share them only in aggregate.
When you browse the site
- Hosting and security: Cloudflare hosts the site. To deliver pages and protect the site from attacks, it processes your IP address, browser details and the pages you request. Errors from our signup form are logged in our Cloudflare account.
- Cloudflare Web Analytics: we use it to count page views and measure page speed. It doesn't use cookies, doesn't record query strings, and, according to Cloudflare, doesn't track individual visitors across websites. We see only aggregate figures, such as pages viewed, referring sites, countries, browsers, devices and load times.
Sponsors and advertisers
If you buy a sponsorship or ad placement, Stripe's checkout collects your contact name, email address, billing address, company name and website, and your payment details. We receive these details and the payment status from Stripe. Card data is held by Stripe only; we never see your full card number.
When you contact us
If you email us, we keep your message, your email address and anything else you choose to send. Mail to our address is forwarded by Cloudflare Email Routing to a Gmail mailbox provided by Google LLC (USA).
What we don't collect
Unless you buy a sponsorship (see above), we don't ask for your name, postal address, phone number or payment details. We don't take bookings or payments for travel; sponsor payments are handled by Stripe and we never see full card numbers.
4. Cookies
Waribiki Alert sets no tracking or advertising cookies, uses no cross-site tracking, and doesn't store anything in your browser's local storage. Our analytics work without cookies.
Our host Cloudflare may set a strictly necessary security cookie (such as cf_clearance) when it checks that a visitor isn't an automated attack. It's used only to protect the site from abuse, not to track you or for advertising. Under the EU and UK ePrivacy rules, strictly necessary cookies don't need consent, so we don't show a cookie banner. You can block or delete cookies in your browser, but some security checks may then be repeated or fail. Filters and search keep their state in the page address (URL).
If you follow a link to another website, such as an official source or a sponsor's site, that site's own privacy and cookie policies apply.
5. Purpose of use (利用目的)
We use personal information only for these purposes:
- sending the email newsletter and deal alerts you asked for, including the confirmation and welcome emails;
- choosing deals relevant to visitors or residents;
- preventing spam signups and abuse of the site;
- running, securing and improving the site and the email, including aggregate analytics and email open and click statistics;
- for sponsors and advertisers: processing your order, delivering and reviewing your ad, sending receipts, handling cancellations, and keeping accounting and tax records;
- answering your enquiries and correction requests; and
- complying with legal obligations.
If we want to use your information for any other purpose, we'll ask for your consent first, except where the law allows otherwise. We don't sell personal information.
6. Provision to third parties (第三者提供)
We don't provide your personal information to third parties without your consent, except where the law allows. Examples are when the law requires it, or when it's needed to protect someone's life, body or property and we can't get your consent.
When Cloudflare, beehiiv, Stripe and Google handle data for us (section 7), we're entrusting them with it to run our service (委託). That isn't third-party provision. We supervise how they handle it.
Sponsors receive only aggregate figures, such as total readers or clicks. They never receive subscriber lists or email addresses.
7. Overseas transfers (外国にある第三者への提供)
These service providers store or process personal information for us in the United States of America:
| Provider | What it does for Waribiki Alert | What it receives |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosts the website and signup form, stores our subscriber database, protects the site, and provides cookieless web analytics | IP address and request data; signup data (email address, visitor/resident/both choice, signup details); hashed IP addresses; aggregate analytics |
| beehiiv, Inc. (USA) | Stores the subscriber list and sends the confirmation, welcome and newsletter emails | Email address, visitor/resident/both choice, signup source, email open and click data |
| Stripe, Inc. (USA) | Processes sponsor and advertiser payments through Stripe Checkout | Contact name, email address, billing address, company name and website, payment details and payment status |
| Google LLC (USA) | Provides the Gmail mailbox that receives email sent to us | Your email address, your message and anything you attach |
The USA's privacy laws: the United States has no comprehensive federal law on personal information equivalent to the APPI. Certain federal laws cover specific sectors, and some states have their own consumer privacy laws, such as California's CCPA/CPRA.
The providers' measures: each provider publishes its privacy and security measures. See the Cloudflare privacy policy, the beehiiv privacy policy the Stripe privacy policy and the Google privacy policy.
Your consent: the signup form tells you that your data will be stored with providers in the USA. By subscribing, you consent to your personal information going to the providers above, in the USA, for the purposes in section 5. If you buy a sponsorship, you consent to your order details going to Stripe, Inc. in the USA to process your payment. You can ask us for more information about these transfers at aaron@gaijindev.com.
8. How long we keep it
| Data | How long we keep it |
|---|---|
| Subscriber data (our database and beehiiv) | Until you unsubscribe. We delete it within 30 days of your unsubscribing. When you unsubscribe, we keep only a one-way SHA-256 hash of your email address as a suppression record, so we don't email you again. |
| Hashed IP addresses used to limit signups | 30 days |
| Emails you send us | 12 months |
| Sponsor and advertiser transaction records | As long as Japanese tax law requires (e.g. 7 years) |
| Cloudflare Web Analytics | Aggregate only. Cloudflare keeps unsampled data for 7 days, then a reduced aggregate. Reports cover up to the past 6 months. |
9. How we protect it (安全管理措置)
- Organisation: Aaron Chanthavong is responsible for handling personal information, and only the operator can access subscriber data.
- Technical: the site and the signup form use HTTPS. Exporting subscriber data requires a secret access token. We store hashed IP addresses rather than raw ones.
- Minimisation: we collect only what we need to send the email.
- Overseas environment: our providers are in the USA. See section 7 for the legal environment there.
10. Your rights (開示等の請求)
Under the APPI, you can ask us to:
- tell you the purposes for which we use your personal information (利用目的の通知);
- disclose the personal information we hold about you (開示), including records of any provision to third parties (第三者提供記録);
- correct, add to or delete it if it's inaccurate (訂正・追加・削除); and
- stop using it, delete it, or stop providing it to third parties (利用停止・消去・第三者提供の停止), where the law allows.
How to make a request: email aaron@gaijindev.com from the address you subscribed with, so we can confirm it's you. We'll respond without delay. We don't charge a fee for these requests. You can also unsubscribe at any time with the link in every email.
Questions and complaints: contact aaron@gaijindev.com. You can also contact Japan's Personal Information Protection Commission (個人情報保護委員会): https://www.ppc.go.jp/
11. Emails (特定電子メール法)
We email only people who have signed up and confirmed their subscription. Every email shows Waribiki Alert as the sender, includes an unsubscribe link and gives our contact details.
12. EU and UK visitors (GDPR)
If the EU or UK General Data Protection Regulation applies to how we handle your data:
- Controller: Aaron Chanthavong (Waribiki Alert), aaron@gaijindev.com.
- Legal bases:
- consent for the newsletter, including email open and click statistics; you can withdraw it at any time by unsubscribing;
- our legitimate interests in running a secure website, preventing spam signups and understanding aggregate use;
- legal obligation, where the law requires it.
- Your rights: access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. Withdrawing consent doesn't affect processing that has already happened. Email aaron@gaijindev.com and we'll respond within one month.
- Transfers: your data is handled in Japan, which has an adequacy decision from the EU and the UK, and by our providers in the USA (section 7).
- Complaints: you can complain to the data protection authority where you live or work.
13. Age
Waribiki Alert is for people aged 16 and over. If you are under 16, please don't sign up. If you believe someone under 16 has given us personal information, contact us and we'll delete it.
14. Changes
When we change this policy, we'll post the new version here with a new "Last updated" date. If the change is material, we'll also tell subscribers by email.
15. Contact
Aaron Chanthavong, Waribiki Alert (a GaijinDev project), operated in Japan Email: aaron@gaijindev.com Address: disclosed without delay upon request